Data Processing Agreement

1. About this agreement

This Data Processing Agreement (“DPA”) is between the business that holds a Barbly account (“you”, the controller) and Jonty Oglesby, trading as Barbly (“Barbly”, “we”, the processor):

Business

Jonty Oglesby, a sole trader, trading as Barbly

Address

Postal address available on request at hello@barbly.uk

Email

hello@barbly.uk

Data protection

ICO registration: in progress

VAT

Not VAT registered

It sets out the terms required by Article 28(3) of the UK GDPR for the personal data we process for you. It forms part of our Terms of Service and you accept it when you accept them. Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings in the UK GDPR. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

2. Details of the processing

Subject matter

Providing the Barbly booking service to you under the Terms.

Duration

For as long as you have a Barbly account, and then until the data is deleted as described in Deletion or return at the end.

Nature

Collecting (through your booking page and your staff), storing, organising, displaying, emailing, exporting and deleting personal data, and passing payment details to Stripe at your customers’ request.

Purpose

To run your booking page, diary and client records; send booking confirmations, reminders, cancellation and refund notices and “Same again?” emails in your name; take deposits and prepayments through your Stripe account; and support you.

Types of personal data

Customers: name, email address, phone number, bookings (service, barber, date and time, price, payment and attendance status), notes left by the customer or your staff, visit history, preferred barber, and email preferences. Staff (your barbers, including those you give their own Barbly login): name, role and photo; for staff with a login, their email address and login and security data (a hashed password, login sessions, 2-step verification settings, passkey public keys and hashed recovery codes); working hours, time off and their requests to change them; pay rule (owner, employed, commission percentage or chair rent) and its history; and the bookings they take and the takings, commission and rent Barbly works out from them. Special category data only where you choose to record it with the customer’s explicit consent (for example a health note), which Barbly asks your staff not to do otherwise.

Data subjects

Your customers and people who book with you, and your barbers and other staff, including staff with their own Barbly login.

3. Your instructions

We process the personal data only on your documented instructions, including about transfers outside the UK. Your instructions are the Terms, this DPA, and what you set up and do in Barbly. We’ll tell you straight away if we think an instruction breaks Data Protection Law.

If UK law requires us to process the data in some other way, we’ll tell you before we do, unless the law forbids that. We don’t sell the data, use it for our own marketing, or combine it with other shops’ data.

You’re responsible for having a lawful basis for the processing and for giving your customers the information the law requires. We provide a privacy notice on your booking page to help with that.

4. Confidentiality

Only people who need access to provide the Service can see the personal data, and each is bound by confidentiality. Today that is Barbly’s operator. Anyone we bring in later (staff or contractors) will be bound in the same way before they get access.

5. Security

We take appropriate technical and organisational measures to protect the personal data, as Article 32 of the UK GDPR requires, taking into account the risks to your customers and staff. The measures we use today are listed in Annex A. We may improve them over time but won’t reduce the overall level of protection.

6. Sub-processors

You give us general authorisation to use sub-processors. The current ones are in Annex B. Each is bound by a written contract with data protection obligations at least as protective as this DPA, and we stay responsible to you for what they do.

Before we add or replace a sub-processor, we’ll email the account owner at least 30 days in advance (14 days if we need to make an urgent change to keep the Service secure or running) and update this page. You can object on reasonable data protection grounds by emailing hello@barbly.uk within that period. We’ll try to find a solution; if we can’t, you can close your account before the change takes effect and we’ll refund any fees you’ve paid for the time after that.

Stripe is not a sub-processor. Card payments are made into your own Stripe account under your agreement with Stripe, and Stripe acts as an independent controller of the payment data.

7. Helping you with requests and assessments

Taking into account the nature of the processing, we help you respond to people exercising their rights (access, rectification, erasure, restriction, objection and portability). Barbly already lets you view, correct, export (CSV) and delete a customer’s record, and stops “Same again?” emails automatically when a customer unsubscribes. If we receive a request about your customers directly, we’ll pass it to you without undue delay and won’t answer it ourselves unless you ask us to.

We’ll also give you the information you reasonably need about our processing for your data protection impact assessments, any prior consultation with the ICO, and your security and breach obligations under Articles 32 to 36 of the UK GDPR.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we’ll tell you without undue delay, and we aim to do so within 48 hours. We’ll email the account owner with what we know: what happened, the kinds and rough numbers of people and records affected, the likely consequences, what we’ve done and propose to do, and who to contact. If we don’t know everything at first, we’ll send updates as we find out more.

We’ll take reasonable steps to contain the breach and limit its effects, and we’ll help you meet your own duty to notify the ICO (within 72 hours) and, where needed, the people affected.

9. Deletion or return at the end

You can export your customers, bookings and shop set-up at any time from Account & data, including after you close your account and until the data is deleted. That is how we return the data to you.

When you close your account, we delete all the personal data we process for you 30 days later. If your account pauses (a trial ends without a plan, or the subscription ends or goes unpaid), we delete it 60 days after it pauses. We email the account owner 7 days before either. Deleted data drops out of our rolling backups within 30 days. We keep nothing afterwards unless UK law requires us to.

10. Information and audits

We’ll make available the information you reasonably need to show that we meet Article 28, and answer reasonable written questions about our processing. If that isn’t enough, or a regulator requires it, we’ll allow an audit by you or an independent auditor you appoint, with at least 30 days’ written notice, no more than once a year (unless after a breach), during working hours, at your cost, and under a duty of confidentiality. Audits must not give access to other shops’ data.

11. International transfers

Barbly’s servers and backups are in the UK. We transfer personal data outside the UK only where Data Protection Law allows it: to countries covered by UK adequacy regulations (such as the EEA), under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or to US companies certified under the UK Extension to the EU-US Data Privacy Framework. The transfers we make today, and the safeguards we rely on, are in Annex B.

12. Liability, order and term

• Each of us is liable for its own breaches of Data Protection Law. The limits in the Terms apply to this DPA, except where the law doesn’t allow them to.
• If this DPA and the Terms conflict on data protection, this DPA wins.
• This DPA lasts as long as we process personal data for you, and its deletion, confidentiality and security terms continue until the data is deleted.
• We may update this DPA when the law or our providers change, on the same notice as changes to the Terms. It is governed by the law of England and Wales.

13. Annex A: Security measures

In transit and at rest

• All traffic to Barbly, including shop booking pages and custom domains, is encrypted with TLS (HTTPS), with certificates issued and renewed automatically.
• The database and uploaded photos are stored on a dedicated virtual server in the UK (IONOS). The database isn’t reachable from the internet.
• Emails are handed to our email provider over its HTTPS API.

Accounts and access

• Passwords are hashed with scrypt and a unique salt. Login sessions, password-reset links and 2-step recovery codes are stored only as SHA-256 hashes, so a copy of the database can’t be used to log in.
• 2-step verification is available to every user (authenticator app or passkey) and is required for Barbly staff. Authenticator secrets are encrypted with AES-256-GCM.
• Repeated wrong passwords are rate-limited, and users are emailed when their password or 2-step settings change.
• Least access: only Barbly’s operator can reach the server and database. Shop staff see only their own shop, and barbers can’t export the client list.
• Support access to a shop is through an audited “log in as owner” tool: each use is recorded (who, when, which shop), sessions end after 2 hours, and support can’t export data or close the account.

Application

• Every database query for shop data is scoped to the logged-in shop, and all input is checked on the server.
• Uploaded images are re-encoded, resized and stripped of metadata such as GPS location.
• Card details never reach Barbly: customers pay on Stripe’s hosted pages.
• Unsubscribe links are signed (HMAC-SHA256) so they can’t be guessed or altered.

Resilience and deletion

• The database and photos are backed up every night and backups are kept for 30 days. Each backup is checked automatically and a failed one is flagged. An encrypted copy is also kept off the server, on Barbly’s own storage in the UK, and the key to decrypt it is never stored on the server.
• Deletion is automatic, on the schedule in Deletion or return at the end, and each deletion is recorded.
• Expired sessions and used or expired reset links are removed automatically.

14. Annex B: Sub-processors and transfers

For card payments, Stripe acts as an independent controller (not a sub-processor), under the agreement each shop accepts with Stripe.